Uwierzytelnianie Kerberos

Tip

Ucz się i ćwicz Hacking AWS:HackTricks Training AWS Red Team Expert (ARTE)
Ucz się i ćwicz Hacking GCP: HackTricks Training GCP Red Team Expert (GRTE) Ucz się i ćwicz Hacking Azure: HackTricks Training Azure Red Team Expert (AzRTE)

Wsparcie dla HackTricks

Sprawdź świetny wpis: https://www.tarlogic.com/en/blog/how-kerberos-works/

TL;DR dla atakujących

  • Kerberos jest domyślnym protokołem uwierzytelniania AD; większość łańcuchów lateral-movement będzie go wykorzystywać. Dla praktycznych ściąg (AS‑REP/Kerberoasting, ticket forging, delegation abuse, etc.) zobacz: 88tcp/udp - Pentesting Kerberos

Fresh attack notes (2024‑2026)

  • RC4 finally going away – Windows Server 2025 DCs no longer issue RC4 TGTs; Microsoft plans to disable RC4 as default for AD DCs by end of Q2 2026. Environments that re‑enable RC4 for legacy apps create downgrade/fast‑crack opportunities for Kerberoasting.
  • PAC validation enforcement (Apr 2025) – April 2025 updates remove “Compatibility” mode; forged PACs/golden tickets get rejected on patched DCs when enforcement is enabled. Legacy/unpatched DCs remain abusable.
  • CVE‑2025‑26647 (altSecID CBA mapping) – If DCs are unpatched or left in Audit mode, certificates chained to non‑NTAuth CAs but mapped via SKI/altSecID can still log on. Events 45/21 appear when protections trigger.
  • NTLM phase‑out – Microsoft will ship future Windows releases with NTLM disabled by default (staged through 2026), pushing more auth to Kerberos. Expect more Kerberos surface area and stricter EPA/CBT in hardened networks.
  • Cross‑domain RBCD remains powerful – Microsoft Learn notes that resource‑based constrained delegation works across domains/forests; writable msDS-AllowedToActOnBehalfOfOtherIdentity on resource objects still allows S4U2self→S4U2proxy impersonation without touching front‑end service ACLs.

Quick tooling

  • Rubeus kerberoast (AES default): Rubeus.exe kerberoast /user:svc_sql /aes /nowrap /outfile:tgs.txt — outputs AES hashes; plan for GPU cracking or target pre‑auth disabled users instead.
  • RC4 downgrade target hunting: enumerate accounts that still advertise RC4 with Get-ADObject -LDAPFilter '(msDS-SupportedEncryptionTypes=4)' -Properties msDS-SupportedEncryptionTypes to locate weak kerberoast candidates before RC4 is fully disabled.

References

Tip

Ucz się i ćwicz Hacking AWS:HackTricks Training AWS Red Team Expert (ARTE)
Ucz się i ćwicz Hacking GCP: HackTricks Training GCP Red Team Expert (GRTE) Ucz się i ćwicz Hacking Azure: HackTricks Training Azure Red Team Expert (AzRTE)

Wsparcie dla HackTricks